Attack Context

Black-box Research

Attacks requiring no knowledge of model internals

736 matching entries

Black-box research results

736 entries

Diffusion Context Nesting Jailbreak

Published Jan 30, 2026Analyzed Feb 21, 2026Source: arXiv

Diffusion Large Language Models (D-LLMs) are vulnerable to a "Context Nesting" attack that bypasses safety alignment mechanisms. While D-LLMs typically utilize a stepwise reduction effect during the iterative denoising process to suppress harmful content, this mechanism fails when harmful requests are embedded within benign, structured contexts. By wrapping a malicious query inside high-level structural templates (such as code completion, table filling, JSON, or YAML formats), an attacker can…

A Fragile Guardrail: Diffusion LLM's Safety Blessing and Its Failure Mode

Evaluated models: GPT-4o

Optimal Transport Bot Cloaking

Published Jan 30, 2026Analyzed Mar 9, 2026Source: arXiv

Graph Neural Network (GNN)-based social bot detection systems are vulnerable to an Optimal Transport (OT)-guided evasion attack that manipulates local graph structures under realistic domain constraints. By modeling $k$-hop ego-neighborhoods as probability measures over spatio-temporal features, an attacker can compute an optimal transport plan to identify "cloak templates" (existing bots near the decision boundary that are misclassified as humans). The attacker can then decode this plan into…

Optimal Transport-Guided Adversarial Attacks on Graph Neural Network-Based Bot Detection

Evaluated models: Not reported

Payment Protocol Whisper Attack

Published Jan 30, 2026Analyzed Feb 21, 2026Source: arXiv

The Google Agent Payments Protocol (AP2), specifically within the reference implementation built using the Google Agent Development Kit (ADK) and Gemini models, contains vulnerabilities allowing for both indirect and direct prompt injection. The architecture fails to sufficiently isolate the Large Language Model (LLM) context from untrusted external data sources and user inputs.

Whispers of Wealth: Red-Teaming Google's Agent Payments Protocol via Prompt Injection

Evaluated models: Gemini 2.5 Flash

Query-Agnostic Retrieval Poisoning

Published Jan 30, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in Large Language Model-based Retrieval (LLMR) systems allows attackers to intentionally hide specific documents from being retrieved (e.g., in RAG pipelines or search engines) by appending a small number of adversarially crafted, query-agnostic tokens. The attack operates in a complete black-box setting: it requires no knowledge of the victim's queries, the target retrieval model's parameters, or the underlying document corpus. By utilizing Document-Query Adversarial (DQ-A)…

" Someone Hid It": Query-Agnostic Black-Box Attacks on LLM-Based Retrieval

Evaluated models: Mistral 7B, Qwen 2.5 7B

Semantic Cache Collision Hijack

Published Jan 30, 2026Analyzed Mar 9, 2026Source: arXiv

Semantic caching mechanisms in LLM applications are vulnerable to cross-tenant cache key collision attacks (CacheAttack) due to the inherent mathematical conflict between locality-preserving fuzzy hashing and cryptographic collision resistance (the avalanche effect). An attacker can leverage gradient-based search algorithms to optimize an adversarial discrete suffix that, when appended to a malicious prompt, forces its output embedding vector to collide with the embedding of a targeted benign…

From Similarity to Vulnerability: Key Collision Attack on LLM Semantic Caching

Evaluated models: Llama 3.1 8B, Mistral 7B, DeepSeek R1

Semantics-Preserving Detector Evasion

Published Jan 30, 2026Analyzed Feb 21, 2026Source: arXiv

LLM-based vulnerability detection systems (used in static application security testing and code review pipelines) are susceptible to semantics-preserving adversarial evasion attacks. Attackers can bypass detection mechanisms by injecting gradient-optimized "universal adversarial strings" into specific code regions—defined as "carriers"—that do not alter the program's compilation or execution logic. These carriers include non-executable regions (code comments, inactive preprocessor directives)…

Syntax- and Compilation-Preserving Evasion of LLM Vulnerability Detectors

Evaluated models: Qwen 2.5 Coder 14B, Qwen 2.5 Coder 32B, Llama 3.1 8B+4 more

Qwen 2.5 Coder 14B
Qwen 2.5 Coder 32B
Llama 3.1 8B
CodeAstra
StarCoder2 15B
GPT-4o
GPT-5 Mini

Universal MLLM Target Matching

Published Jan 30, 2026Analyzed Feb 22, 2026Source: arXiv

Closed-source Multi-modal Large Language Models (MLLMs) are vulnerable to Universal Targeted Transferable Adversarial Attacks (UTTAA). An attacker can generate a single, image-agnostic adversarial perturbation ($\delta$) that, when added to any arbitrary source image, steers the victim model to output a description or classification matching a specific target image chosen by the attacker. This vulnerability exploits the transferability of adversarial features from open-source surrogate vision…

Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization

Evaluated models: GPT-4o, Claude Sonnet 4.5, GPT-5+2 more

GPT-4o
Claude Sonnet 4.5
GPT-5
GPT-5.2
Claude Opus 4.5

Adaptive Multimodal Reasoning Jailbreaks

Published Jan 29, 2026Analyzed Jul 20, 2026Source: arXiv

The paper reports a black-box jailbreak evaluation in which a ReAct-style loop adaptively rewrites unsafe text prompts and selectively applies blur, DCT filtering, or recoloring to image regions identified as safety-sensitive. The combined cross-modal strategy is intended to make harmful image-text requests appear less objectionable to a vision-language model while preserving enough semantics to elicit an answer. This is a specific, security-relevant evaluation, although the reported results…

Jailbreaks on Vision Language Model via Multimodal Reasoning

Evaluated models: Gemini 2.0 Flash

Autonomous Agent Prompt Reveal

Published Jan 29, 2026Analyzed Feb 21, 2026Source: arXiv

A vulnerability exists in Large Language Model (LLM) deployments and multi-agent systems where an autonomous attacker agent can systematically extract hidden system prompts through self-evolving interaction strategies. The vulnerability leverages a "JustAsk" framework which utilizes Upper Confidence Bound (UCB) exploration to dynamically select and refine attack vectors from a hierarchical taxonomy of 14 atomic skills (e.g., structural formatting, authority appeals) and 14 multi-turn…

Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs

Evaluated models: o1, Llama 3.1 70B Hanami X1, Phi-4+38 more

o1
Llama 3.1 70B Hanami X1
Phi-4
Aion 1.0
Sonar Pro
Command A
Llama 4 Maverick
Llama 3.1 Nemotron Ultra 253B v1
Qwen 3 235B-A22B
Mercury
Hunyuan A13B Instruct
UI-TARS 1.5 7B
GPT-oss 120B
Jamba Mini 1.7
Hermes 4 70B
Step 3
LongCat Flash Chat
Tongyi DeepResearch 30B-A3B
Cydonia 24B v4.1
ERNIE 4.5 21B-A3B Thinking
Granite 4.0 H Micro
LFM2 8B-A1B
Nova Premier v1
Kimi K2 Thinking
KAT Coder Pro
Cogito v2.1 671B
Gemini 3 Pro Preview
Grok 4.1 Fast
Claude Opus 4.5
TNG R1T Chimera
Intellect 3
DeepSeek V3.2 Speciale
Trinity Mini
Mistral Large 2512
DeepSeek V3.1 Nex N1
MiMo V2 Flash
GLM-4.7
MiniMax M2.1
Seed 1.6
Molmo 2 8B
GPT-5.2 Codex

Cross-Image Contagion

Published Jan 29, 2026Analyzed Feb 22, 2026Source: arXiv

Multi-modal Large Language Models (MLLMs) capable of processing interleaved image-text sequences are vulnerable to a universal adversarial perturbation (UAP) attack known as LAMP. This vulnerability allows an attacker to generate a single, noise-based perturbation pattern using a surrogate model (e.g., Mantis-CLIP) that transfers effectively to black-box target models. The attack leverages two novel loss functions during perturbation learning: a "contagious" objective that manipulates…

LAMP: Learning Universal Adversarial Perturbations for Multi-Image Tasks via Pre-trained Models

Evaluated models: Mantis-CLIP, Mantis-SIGLIP, Mantis-Idefics2+4 more

Mantis-CLIP
Mantis-SIGLIP
Mantis-Idefics2
VILA 1.5
LLaVA 1.6
Qwen VL Chat
MiniGPT-4

Related research categories